Changing data shown in email alert

[robK123]

I run this search
source="secure" sshd "pam_ldap: error trying to bind as user"|top uid limit=10

which then shows me the top 10 login failures and how many failures they had but I also want it to display the host that failures where on so they are included in the email but I am not sure how to do this?

[jonuwz]

Might be easier to not use the 'top' command to get this information.

i.e.

source="secure" sshd "pam_ldap: error trying to bind as user"
| stats count values(host) as hosts by uid | sort - count | head 10

Update :

here's a search that going to return data - its the same concept..

index=_internal sourcetype=splunkd earliest=-1h@h latest=@h | bin _time span=15m 
| stats count values(_time) as times by group | sort - count | head 10

[jonuwz]

In that case there's no data returned by the 1st part of the search. See update

[robK123]

Thanks but when I run that it returns no results.